An electronic funds transfer authorization form is the written permission that lets an employer, biller, or other third party move money into or out of your bank account through the ACH network. Federal law requires that authorization to be in writing before any recurring transfer touches your account, and signing one triggers a set of rights that run in both directions: the payee gets to pull or push funds on schedule, and you get specific protections if a transfer is wrong, unauthorized, or larger than expected.
Why the Form Has to Be in Writing
The Electronic Fund Transfer Act, at 15 U.S.C. § 1693e, requires that any preauthorized transfer from your account be authorized “only in writing,” and the entity collecting the authorization must give you a copy.1Office of the Law Revision Counsel. 15 USC 1693e – Preauthorized Transfers The implementing rule, Regulation E at 12 CFR § 1005.10(b), mirrors that requirement and extends it to electronic signatures, so an authorization completed through a secure online portal with an e-signature counts just as a paper form does.2eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
A verbal agreement to debit your account is not legally sufficient for recurring transfers. If a company starts pulling money without a signed or similarly authenticated form, you have grounds to dispute every one of those charges. That written-authorization rule is the reason employers, utilities, and subscription services all hand you a form before the first dollar moves.
What Information the Form Requires
Every EFT authorization form collects the same core banking details:
- The name of your bank
- Whether the account is checking or savings
- The nine-digit ABA routing number that identifies your financial institution
- Your individual account number3U.S. Bank. U.S. Bank Routing Number
The routing number appears at the bottom left of a check, followed by the account number. Many employers and billers ask for a voided check to capture both numbers accurately, but a bank letter or an online banking screenshot often works too.4Nacha. Direct Deposit Without a Voided Check? Absolutely!
The name on the form has to match the name on your bank account exactly. Small differences in formatting or spelling can get the authorization rejected. Beyond the account details, the form typically identifies the transfer amount (or states it will vary), the frequency (weekly, biweekly, monthly), and the effective date. Check every field twice before submitting. A single transposed digit in a routing or account number can send money to the wrong account, and unwinding that takes time.
Submitting the Form Securely
Because the form carries sensitive banking data, it needs to reach the requesting organization through a secure channel. Most companies use encrypted online portals or e-signature platforms. In workplaces that still handle things on paper, the form goes to HR or payroll in person or in a sealed envelope. Don’t send bank account details by unencrypted email.
After the form is processed, the receiving organization often sends a prenote, a zero-dollar test entry through the ACH network to verify that your routing and account numbers are valid. Under Nacha operating rules, the organization must wait at least three banking days after the prenote before sending the first live transaction.5Nacha. Definition of Banking Day and Related Operational Topics Some employers stretch that waiting period to a full pay cycle out of caution, so don’t be alarmed if your first paycheck still arrives as a paper check.
When the Amount Changes Month to Month
Many recurring debits, like utility bills or variable loan payments, don’t hit your account for the same amount each cycle. Regulation E addresses this directly. When a preauthorized debit will differ in amount from the previous transfer, the payee or your bank must send you written notice of the new amount and the scheduled date at least 10 days before the transfer.6Consumer Financial Protection Bureau. 12 CFR 1005.10 – Preauthorized Transfers The payee can instead offer to notify you only when a transfer falls outside a range you’ve agreed to, rather than for every fluctuation.
If you never got that advance notice and a larger-than-expected amount was withdrawn, you have a legitimate basis for disputing the transfer.
Stopping a Payment vs. Revoking the Authorization
Stopping a single upcoming payment and revoking the entire authorization are two different actions with two different results, and mixing them up is one of the most common mistakes people make.
Stopping One Transfer
To block one upcoming payment, notify your bank at least three business days before the scheduled date. You can do this orally or in writing.7eCFR. 12 CFR 1005.10 – Preauthorized Transfers If you call, your bank may require written confirmation within 14 days; without that follow-up, the oral stop-payment order expires.1Office of the Law Revision Counsel. 15 USC 1693e – Preauthorized Transfers Most banks charge a fee for each stop-payment order. A stop-payment only blocks the specific transfer you identified. The underlying authorization stays active, and the next scheduled payment will go through unless you take further action.
Revoking the Whole Authorization
To end all future transfers, revoke the authorization in full. Notify both your bank and the company that’s been debiting your account, and put it in writing. The three-business-day advance notice still applies for the next scheduled debit, so don’t wait until the last minute. Once revoked, any subsequent debit under the old authorization is unauthorized, and you can dispute it.
Keep copies of every revocation notice, including proof of delivery. If a company continues debiting your account after you’ve revoked, those records are your evidence.
Disputing an Unauthorized or Incorrect Transfer
If you spot an incorrect or unauthorized transfer, you have 60 days from the date your bank sends the statement containing the error to file a notice of error. The notice can be oral or written.8eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Once your bank receives it, a strict investigation clock starts.
Your bank has 10 business days to investigate and determine whether an error occurred. It then has three business days to report the results to you and one business day to correct any confirmed error. If the bank can’t finish within 10 business days, it may take up to 45 days total, but only if it provisionally credits your account for the disputed amount within those first 10 business days and gives you full use of those funds during the investigation.8eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
If the investigation finds no error, the bank can reverse the provisional credit, but it must give you written notice explaining why and a copy of the documents it relied on. When you file a dispute, include the date and amount of the transfer, explain why you believe it’s an error, and keep a copy of everything you send.
Your Liability for Unauthorized Transfers
Regulation E caps how much you can lose to unauthorized electronic transfers, but only if you act quickly. The tiers are built around how fast you report:
- Notify your bank within two business days of learning your access device was lost or stolen, and your maximum liability is $50, or the amount of unauthorized transfers before you gave notice, whichever is less.9eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Miss the two-day window but report within 60 days of the bank statement being sent, and your exposure rises to a maximum of $500.9eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Fail to report within 60 days of the statement that first showed the unauthorized transfers, and you can be liable for the full amount of any unauthorized transfers that occur after that 60-day window closes.9eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
Review your statements every month. The difference between catching a fraudulent debit in week one and finding it four months later is the difference between losing $50 and losing everything that was taken.
Employer Direct Deposit: What They Can and Can’t Require
If your employer hands you an EFT authorization form as part of onboarding, federal law sets limits on what they can require. Under 15 U.S.C. § 1693k, no employer can force you to open an account at a specific bank as a condition of employment.1Office of the Law Revision Counsel. 15 USC 1693e – Preauthorized Transfers The CFPB’s interpretation of Regulation E goes further: an employer may require direct deposit as the payment method, but only if you get to choose which bank receives the funds. Alternatively, the employer can designate a specific bank but must offer you the option of pay by check or another method.6Consumer Financial Protection Bureau. 12 CFR 1005.10 – Preauthorized Transfers
State laws add another layer. Some states restrict mandatory direct deposit more tightly than federal law or require specific alternative payment options. If your employer insists on direct deposit to a bank you didn’t choose and won’t offer any alternative, that’s worth raising with your state labor department.